UBUNTU-CVE-2026-13221

    Dashboard / Vulnerabilities / UBUNTU-CVE-2026-13221

    UBUNTU-CVE-2026-13221

    Published: 13 Jul 2026Last Modified: 10 Sept 2026
    Upstream:
    CVE-2026-13221

    Summary:

    Details: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

    References: https://ubuntu.com/security/CVE-2026-13221, https://www.cve.org/CVERecord?id=CVE-2026-13221, https://lists.security.metacpan.org/cve-announce/msg/41780104/, https://github.com/Perl/perl5/issues/23388, https://ubuntu.com/security/notices/USN-8675-1, https://ubuntu.com/security/notices/USN-8684-1, https://ubuntu.com/security/notices/USN-8675-2

    Affected packages

    Package

    Name: perl

    Purl: pkg:deb/ubuntu/perl?arch=source&distro=esm-infra-legacy%2Ftrusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.18.2-2ubuntu1.7+esm8

    Affected versions

    5.14.2-21build1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2026-13221 | CVE-DB